mirror of
https://github.com/lancedb/lancedb.git
synced 2026-10-30 15:26:52 +00:00
Jack Ye
ddb318567a
## Summary - Complete the SQL reference: `ATTACH DATABASE`, the `CHANGES` clause, and `dedupe()`/`duplicate_pairs()` (verified against current sophon source; these were recently renamed from `vector_dedup`/`vector_duplicate_pairs`). Fix the blob-column default-projection claim and add the previously undocumented `blob_descriptor()`. - Enrich the gated Functions draft (still `.mintignore`'d, pre-release): chained Functions over blob outputs, GPU-produced blobs, Secrets, multi-input/output binding, `code=[module]` packaging. - Upgrade the materialized-view and computed-column auto-refresh drafts with precise, verified catch-up semantics, and add the missing `ALTER MATERIALIZED VIEW` / `CREATE ... WITH(...)` sections (also gated — the automatic-refresh scheduler is still dev/staging-only). - Thread one running example (video frames → GPU extract/caption → dedup → auto-refreshing materialized view) through Functions, materialized views, and the LeRobotDataset integration guide instead of a separate tutorial. - Rename "LanceDB OSS"/"OSS" to "LanceDB Embedded"/"Embedded" throughout (52 files); activate the existing availability-comparison mechanism on `basics/offerings.mdx` for a full feature-by-feature comparison table.
78 lines
2.7 KiB
Plaintext
78 lines
2.7 KiB
Plaintext
---
|
|
title: "Grant"
|
|
sidebarTitle: "Grant"
|
|
description: "GRANT and REVOKE: privileges on Secrets and Functions."
|
|
icon: user-lock
|
|
keywords: ["grant", "revoke", "privileges", "authorization", "sql", "ownership"]
|
|
---
|
|
|
|
<Badge color="red">Enterprise</Badge> [SQL runs in LanceDB Enterprise.](/sql)
|
|
|
|
```sql
|
|
GRANT <privilege>[, ...] ON { SECRET | FUNCTION } <name> TO <grantee>[, ...]
|
|
GRANT <privilege>[, ...] ON SCHEMA <namespace> TO <grantee>[, ...]
|
|
REVOKE <privilege>[, ...] ON ... FROM <grantee>[, ...]
|
|
```
|
|
|
|
```sql
|
|
GRANT USAGE, UPDATE ON SECRET api_key TO ROLE readers, writers
|
|
GRANT CREATE FUNCTION ON SCHEMA analytics TO ROLE data_science
|
|
REVOKE USAGE ON FUNCTION embed FROM ROLE readers
|
|
```
|
|
|
|
## Privileges {#privileges}
|
|
|
|
| Privilege | Allows |
|
|
| --- | --- |
|
|
| `OWNERSHIP` | everything on the object |
|
|
| `USAGE` | using it: binding a Secret's value, calling a Function |
|
|
| `UPDATE` | changing it |
|
|
| `CREATE SECRET` | creating a Secret inside a `SCHEMA` |
|
|
| `CREATE FUNCTION` | creating a Function inside a `SCHEMA` |
|
|
|
|
<Warning>
|
|
`OWNERSHIP` cannot be revoked, only granted to someone else, which transfers
|
|
it: an object always has exactly one owner. `GRANT OWNERSHIP` is refused with
|
|
more than one grantee for the same reason.
|
|
</Warning>
|
|
|
|
These are a subset of the full privilege model; see
|
|
[Authorization](/governance/authorization#privileges) for privileges on
|
|
tables, views and namespaces, which this statement does not grant.
|
|
|
|
## Grantees {#grantees}
|
|
|
|
```sql
|
|
<grantee> ::= [ ROLE ] <role> | [ { USER | GROUP } ] { <name> | ID '<id>' }
|
|
```
|
|
|
|
```sql
|
|
GRANT USAGE ON SECRET api_key TO ROLE readers, USER alice, GROUP ID 'g1'
|
|
```
|
|
|
|
A grantee is a role, or a user or group named by its identity-directory name
|
|
or its directory ID. A grantee with no leading `ROLE`/`USER`/`GROUP` keyword
|
|
takes the kind of the one before it, so `TO ROLE a, b` names two roles --
|
|
but the first grantee in the list always needs its keyword. An unquoted name
|
|
is folded to lowercase before it is looked up; a quoted name is looked up
|
|
exactly as written.
|
|
|
|
## Naming the target {#targets}
|
|
|
|
A `SECRET` or `FUNCTION` target can be qualified with its namespace and
|
|
database, the same as anywhere else: `SECRET analytics.api_key`,
|
|
`SECRET db1.analytics.api_key`. A `SCHEMA` target is the namespace itself.
|
|
There is no `TABLE` target: table privileges are granted through
|
|
[Authorization](/governance/authorization), not this statement.
|
|
|
|
## What to read next {#next}
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="Authorization" icon="user-shield" href="/governance/authorization">
|
|
The full privilege model, and how creation privileges resolve upward.
|
|
</Card>
|
|
<Card title="Namespace" icon="folder-tree" href="/sql/ddl/namespace">
|
|
Creating the schemas these privileges apply to.
|
|
</Card>
|
|
</CardGroup>
|